1800 matches found
CVE-2021-29002
A stored cross-site scripting XSS vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.sitetitle" parameter...
CVE-2021-29002
CVE-2021-29002 is a stored XSS vulnerability in Plone CMS 5.2.3 affecting the site-controlpanel via the form.widgets.site_title parameter. The connected documents consistently describe a stored XSS in Plone 5.2.3 (no details on a fixed version or patch in the provided sources). Impact is injectio...
CVE-2021-29002: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.sitetitle" parameter...
Plone 跨站脚本漏洞
Plone is an open source content management system CMS built on the Zope application server. A cross-site scripting vulnerability exists in Plone version 5.2.3, which stems from the form.widgets.sitetitle parameter not effectively filtering user input, and can be exploited by an attacker to inject...
PT-2021-18016
Name of the Vulnerable Software and Affected Versions: Plone CMS version 5.2.3 Description: A stored cross-site scripting XSS issue exists in the site-controlpanel via the form.widgets.site title parameter. This allows for potential malicious script execution. Recommendations: For Plone CMS versi...
Plone CMS 5.2.3 - (Title) Stored XSS Vulnerability
Exploit Title: Plone CMS 5.2.3 - 'Title' Stored XSS Exploit Author: Piyush Patil Vendor Homepage: https://plone.com/ Software Link: https://github.com/plone/Products.CMFPlone/tags Version: 5.2.3 Tested on: Windows 10 Reference - https://github.com/plone/Products.CMFPlone/issues/3255 Steps to...
Plone CMS 5.2.3 Cross Site Scripting
Exploit Title: Plone CMS 5.2.3 - 'Title' Stored XSS Date: 18-03-2021 Exploit Author: Piyush Patil Vendor Homepage: https://plone.com/ Software Link: https://github.com/plone/Products.CMFPlone/tags Version: 5.2.3 Tested on: Windows 10 Reference -...
Plone CMS 5.2.3 - 'Title' Stored XSS
Exploit Title: Plone CMS 5.2.3 - 'Title' Stored XSS Date: 18-03-2021 Exploit Author: Piyush Patil Vendor Homepage: https://plone.com/ Software Link: https://github.com/plone/Products.CMFPlone/tags Version: 5.2.3 Tested on: Windows 10 Reference -...
Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager
Impact What kind of vulnerability is it? Who is impacted? Information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. Patches Has the problem been patched? What versions should users upgrade to? The problem has...
GHSA-P75F-G7GX-2R7P Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager
Impact What kind of vulnerability is it? Who is impacted? Information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. Patches Has the problem been patched? What versions should users upgrade to? The problem has...
Plone CMS < 5.2.3 Multiple Vulnerabilities
Plone CMS is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Plone Server-Side Request Forgery Vulnerability
Plone is an open source content management system. A server-side request forgery vulnerability exists in Plone versions prior to 5.2.3. An attacker can exploit this vulnerability by backtracking to conduct server-side request forgery attacks...
Plone XXE Vulnerability
Plone is an open source content management system. A XXE XML External Entity Injection vulnerability exists in Plone versions prior to 5.2.3. An attacker can exploit this vulnerability to conduct XXE attacks...
Plone XXE vulnerability (CNVD-2021-01549)
Plone is an open source content management system. A XXE XML External Entity Injection vulnerability exists in Plone versions prior to 5.2.3. An attacker can exploit this vulnerability to conduct XXE attacks...
CVE-2020-28734
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...
CVE-2020-28735
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
CVE-2020-28736
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...
CVE-2020-28736
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...